finish user model and security